The Digital Services Act rebuilt the EU’s rules for online intermediaries, in full force since 17 February 2024. Its heart is accountability for content moderation and advertising, but several of its sharpest provisions are privacy rules wearing platform-regulation clothes: bans on sensitive-data ad targeting, bans on profiling ads to minors, recommender transparency, and the dark pattern prohibition. If you operate a service where users post content that others see, some tier of the DSA applies to you.
| Regulation | Regulation (EU) 2022/2065 (DSA) |
|---|---|
| Fully applicable since | 17 February 2024 |
| Max penalty | 6% of global annual turnover |
| Enforcing authority | European Commission (VLOPs); national Digital Services Coordinators |
| Official text | EUR-Lex CELEX 32022R2065 |
Duties by tier
All intermediaries: designate a point of contact and, for non-EU providers, an EU legal representative; publish clear terms including moderation policies; report transparency data.
Hosting services add notice-and-action: a mechanism for anyone to flag illegal content, diligent processing, and a statement of reasons to affected users for removals and restrictions.
Online platforms (hosting plus public dissemination) carry the visible layer: internal complaint handling and out-of-court dispute settlement, measures against abusive notifiers, trusted flagger priority, marketplace trader traceability, no dark patterns (Article 25), ad labeling with targeting disclosure (Article 26), recommender system transparency in terms (Article 27), and protection of minors (Article 28). Micro and small enterprises are exempt from most platform-tier duties.
VLOPs and VLOSEs add the systemic tier: annual assessments of systemic risks (illegal content, fundamental rights, elections, minors’ safety), mitigation measures, independent audits, a non-profiling recommender option, researcher data access (Article 40), ad repositories, and crisis response duties.
The privacy core
Three provisions do data protection work directly. Article 26(3) prohibits showing ads based on profiling with GDPR special category data, ending sensitive-interest targeting regardless of consent. Article 28(2) prohibits profiling-based advertising to users the platform is aware with reasonable certainty are minors. And Article 27 forces recommender transparency: the main parameters of ranking, and options to change them, must be in the terms. Each duplicates or extends GDPR ground covered in our children’s data guide and dark patterns guide, and the deeper transparency duties are covered in the algorithmic transparency guide.
Enforcement is running
The Commission moved quickly against designated platforms: formal proceedings against X (ad repository, verification design, data access), TikTok (minors’ protection, the rewards program, which TikTok withdrew from the EU), Meta (ads transparency, minors), and marketplaces AliExpress and Temu. National coordinators handle the long tail. For a mid-size platform, the pragmatic order is: confirm your tier, stand up notice-and-action with statements of reasons, fix ad labeling and any profiling of minors, and align the consent and tracking layer, which you can verify with a free scan.